skool-rag

SUSPICIOUS: the overall workflow is coherent for a RAG skill and the named external services match the stated purpose, but trust is incomplete because the core Python scripts are unseen, dependencies are unpinned, and four credentials are forwarded into local code. This looks more like a moderately risky, under-specified integration than confirmed malicious behavior.